/**
 * WebSocket / gateway URL transport security (OpenClaw-aligned).
 */
export declare function isInsecurePrivateWsAllowed(): boolean;
/**
 * Returns true when the URL is safe for credentials and sensitive payloads:
 * - wss:// is always allowed
 * - ws:// is allowed only on loopback by default
 * - optional break-glass: private-network ws:// when XOPC_ALLOW_INSECURE_PRIVATE_WS=1
 */
export declare function isSecureWebSocketUrl(url: string, opts?: {
    allowPrivateWs?: boolean;
}): boolean;
export declare function assertSecureWebSocketUrl(url: string, opts?: {
    allowPrivateWs?: boolean;
}): void;
/**
 * Normalize http(s) gateway base URLs for fetch clients; rejects insecure ws targets.
 */
export declare function assertSecureGatewayHttpUrl(url: string): void;